2008-06-11 Cameron Zwarich <cwzwarich@uwaterloo.ca>

        Reviewed by Maciej.

        Bug 19498: REGRESSION (r34497): crash while loading GMail
        <https://bugs.webkit.org/show_bug.cgi?id=19498>

        JavaScriptCore:

        * VM/CodeGenerator.cpp:
        (KJS::CodeGenerator::emitJumpIfTrueOptimized):
        (KJS::CodeGenerator::emitJumpIfTrue):
        * VM/CodeGenerator.h:
        * kjs/nodes.cpp:
        (KJS::DoWhileNode::emitCode):
        (KJS::WhileNode::emitCode):
        (KJS::ForNode::emitCode):
        (KJS::CaseBlockNode::emitCodeForBlock):

        LayoutTests:

        * fast/js/logical-or-jless-expected.txt: Added.
        * fast/js/logical-or-jless.html: Added.
        * fast/js/resources/logical-or-jless.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34500 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 1cdebec5977b202a72012951898df3bbd51a2ea4..6b4fb012a21544b2a83752e505a988f5ca20eb7a 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,20 @@
+2008-06-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 19498: REGRESSION (r34497): crash while loading GMail
+        <https://bugs.webkit.org/show_bug.cgi?id=19498>
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfTrueMayCombine):
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::CaseBlockNode::emitCodeForBlock):
+
 2008-06-11  Darin Adler  <darin@apple.com>
 
         Reviewed by Maciej.

diff --git a/JavaScriptCore/VM/CodeGenerator.cpp b/JavaScriptCore/VM/CodeGenerator.cpp
index a307a28dde1a5978861249d560e97a6a9abdf0ac..47ce839055600c553bce2678e95fce9d2f91ca6e 100644 (file)
--- a/JavaScriptCore/VM/CodeGenerator.cpp
+++ b/JavaScriptCore/VM/CodeGenerator.cpp
@@ -414,7 +414,7 @@ PassRefPtr<LabelID> CodeGenerator::emitJump(LabelID* target)
     return target;
 }
 
-PassRefPtr<LabelID> CodeGenerator::emitJumpIfTrue(RegisterID* cond, LabelID* target)
+PassRefPtr<LabelID> CodeGenerator::emitJumpIfTrueMayCombine(RegisterID* cond, LabelID* target)
 {
     if (m_lastOpcodeID == op_less) {
         int dstIndex;
@@ -433,6 +433,11 @@ PassRefPtr<LabelID> CodeGenerator::emitJumpIfTrue(RegisterID* cond, LabelID* tar
         }
     }
     
+    return emitJumpIfTrue(cond, target);
+}
+
+PassRefPtr<LabelID> CodeGenerator::emitJumpIfTrue(RegisterID* cond, LabelID* target)
+{
     emitOpcode(op_jtrue);
     instructions().append(cond->index());
     instructions().append(target->offsetFrom(instructions().size()));

diff --git a/JavaScriptCore/VM/CodeGenerator.h b/JavaScriptCore/VM/CodeGenerator.h
index a6a3e5cb8effe3e3b89c6f0ab55cfb6ad2178005..6c38ae138dfc8fd30a868093eb1f8f9359d1e442 100644 (file)
--- a/JavaScriptCore/VM/CodeGenerator.h
+++ b/JavaScriptCore/VM/CodeGenerator.h
@@ -260,6 +260,7 @@ namespace KJS {
 
         PassRefPtr<LabelID> emitLabel(LabelID*);
         PassRefPtr<LabelID> emitJump(LabelID* target);
+        PassRefPtr<LabelID> emitJumpIfTrueMayCombine(RegisterID* cond, LabelID* target);
         PassRefPtr<LabelID> emitJumpIfTrue(RegisterID* cond, LabelID* target);
         PassRefPtr<LabelID> emitJumpIfFalse(RegisterID* cond, LabelID* target);
         PassRefPtr<LabelID> emitJumpScopes(LabelID* target, int targetScopeDepth);

diff --git a/JavaScriptCore/kjs/nodes.cpp b/JavaScriptCore/kjs/nodes.cpp
index d687fd5251b83f38b9e5155174bb5c2426d93a93..8639166690e0046e2d9f6449b247b6dced2ae1cb 100644 (file)
--- a/JavaScriptCore/kjs/nodes.cpp
+++ b/JavaScriptCore/kjs/nodes.cpp
@@ -1354,7 +1354,7 @@ RegisterID* DoWhileNode::emitCode(CodeGenerator& generator, RegisterID* dst)
     
     generator.emitLabel(continueTarget.get());
     RegisterID* cond = generator.emitNode(m_expr.get());
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
+    generator.emitJumpIfTrueMayCombine(cond, topOfLoop.get());
     generator.emitLabel(breakTarget.get());
     return result.get();
 }
@@ -1376,7 +1376,7 @@ RegisterID* WhileNode::emitCode(CodeGenerator& generator, RegisterID* dst)
 
     generator.emitLabel(continueTarget.get());
     RegisterID* cond = generator.emitNode(m_expr.get());
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
+    generator.emitJumpIfTrueMayCombine(cond, topOfLoop.get());
 
     generator.emitLabel(breakTarget.get());
     
@@ -1408,7 +1408,7 @@ RegisterID* ForNode::emitCode(CodeGenerator& generator, RegisterID* dst)
     generator.emitLabel(beforeCondition.get());
     if (m_expr2) {
         RegisterID* cond = generator.emitNode(m_expr2.get());
-        generator.emitJumpIfTrue(cond, topOfLoop.get());
+        generator.emitJumpIfTrueMayCombine(cond, topOfLoop.get());
     } else {
         generator.emitJump(topOfLoop.get());
     }
@@ -1576,14 +1576,14 @@ RegisterID* CaseBlockNode::emitCodeForBlock(CodeGenerator& generator, RegisterID
         RegisterID* clauseVal = generator.emitNode(list->getClause()->expr());
         generator.emitStrictEqual(clauseVal, clauseVal, switchExpression);
         labelVector.append(generator.newLabel());
-        generator.emitJumpIfTrue(clauseVal, labelVector[labelVector.size() - 1].get());
+        generator.emitJumpIfTrueMayCombine(clauseVal, labelVector[labelVector.size() - 1].get());
     }
 
     for (ClauseListNode* list = m_list2.get(); list; list = list->getNext()) {
         RegisterID* clauseVal = generator.emitNode(list->getClause()->expr());
         generator.emitStrictEqual(clauseVal, clauseVal, switchExpression);
         labelVector.append(generator.newLabel());
-        generator.emitJumpIfTrue(clauseVal, labelVector[labelVector.size() - 1].get());
+        generator.emitJumpIfTrueMayCombine(clauseVal, labelVector[labelVector.size() - 1].get());
     }
 
     RefPtr<LabelID> defaultLabel;

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6110fd8b855477214584c9458c7728de49feafbf..4f0e625c407204e08b143b6a6af02b1ab6bc536e 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2008-06-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Test for:
+
+        Bug 19498: REGRESSION (r34497): crash while loading GMail
+        <https://bugs.webkit.org/show_bug.cgi?id=19498>
+
+        * fast/js/logical-or-jless-expected.txt: Added.
+        * fast/js/logical-or-jless.html: Added.
+        * fast/js/resources/logical-or-jless.js: Added.
+
 2008-06-11  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Adam Roben.

diff --git a/LayoutTests/fast/js/logical-or-jless-expected.txt b/LayoutTests/fast/js/logical-or-jless-expected.txt
new file mode 100644 (file)
index 0000000..ccee876
--- /dev/null
+++ b/LayoutTests/fast/js/logical-or-jless-expected.txt
@@ -0,0 +1,10 @@
+This test checks whether the pair of opcodes (less, jtrue) is incorrectly optimized in a LogicalOrNode.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS result is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/LayoutTests/fast/js/logical-or-jless.html b/LayoutTests/fast/js/logical-or-jless.html
new file mode 100644 (file)
index 0000000..8ac73f6
--- /dev/null
+++ b/LayoutTests/fast/js/logical-or-jless.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="resources/logical-or-jless.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>

diff --git a/LayoutTests/fast/js/resources/logical-or-jless.js b/LayoutTests/fast/js/resources/logical-or-jless.js
new file mode 100644 (file)
index 0000000..c4e09c9
--- /dev/null
+++ b/LayoutTests/fast/js/resources/logical-or-jless.js
@@ -0,0 +1,10 @@
+description(
+"This test checks whether the pair of opcodes (less, jtrue) is incorrectly optimized in a LogicalOrNode."
+);
+
+var failMessage = "FAIL";
+var temp = failMessage || failMessage;
+var result = 1 < 2 || false;
+shouldBeTrue("result");
+
+var successfullyParsed = true;